It is still relatively easy for criminals to gain access to Instagram, Facebook and email accounts despite measures taken by platforms to deter hackers, research by NOS has shown.

The broadcaster followed the activities of a Nigerian phishing gang and identified 3,200 victims, including 1,000 in the Netherlands. The numbers are likely to be “just a fraction” of the real number of duped account holders, NOS said.

The gang works by presenting potential victims with a false page on which they are asked log in. The criminals then change the password of the Facebook or other account so it becomes inaccessible to the rightful owner.

About a third of the victims who were identified by NOS came from the Netherlands but it could not be established if the gang was targeting Dutch users in particular.

“It is not very advanced. You don’t have to be a brilliant technical genius to do this” internet safety expert Matthijs Koot told the broadcaster.

It is not always clear what the criminals do with the accounts once they have hijacked them. They can be used to spread spam about cryptocurrencies, fake likes or desinformation, Koot said.

Meta, which owns Facebook and Instagram, did not respond to questions as to why the platforms are not better protected against relatively simple criminal phishing activity.

“It’s complicated to protect accounts,” Koot said. “If you monitor too closely, you could exclude users. If people log on to their account from the other side of the world the user may be on holiday, for example.”